Study. uk . com
  1. Home
  2. All questions
  3. Question 180

CompTIA Security+ study material · question 180 of 611

The same coding flaw exists in two code paths, one reachable from the internet and one that is dead code. Why do they carry different risk?

  1. Because dead code cannot be scanned
  2. Because dead code is excluded from CVSS scoring
  3. Because the compiler removes unreachable code
  4. Because a weakness becomes a vulnerability only when a threat can reach it
Show the answer

Answer: D. Because a weakness becomes a vulnerability only when a threat can reach it

Reachability is part of the risk, which is why exposure belongs in prioritisation alongside severity.

Source: NIST SP 800-30 Rev. 1 (NIST) — SP 800-30 Rev. 1 § 2.3.1 Vulnerabilities and Predisposing Conditions

Challenge yourself on this topic → Study as cards